IA-32 architecture system management mode
Intel/AMD processor SMM state save map |
offset |
Intel P5 |
Intel P6 |
AMD K5 |
AMD K6 |
7E00..7EF7h |
reserved |
reserved |
reserved |
reserved |
7EF8h |
SMBASE |
SMBASE |
SMBASE |
SMBASE |
7EFCh |
rev ID |
rev ID |
rev ID |
rev ID |
7F00h |
I/O restart |
I/O restart |
I/O restart |
I/O restart |
7F02h |
HLT restart |
HLT restart |
HLT restart |
HLT restart |
7F04h |
I/O restart EDI |
I/O restart EDI |
I/O restart EDI |
I/O restart EDI |
7F08h |
I/O restart ECX |
I/O restart ECX |
I/O restart ECX |
I/O restart ECX |
7F0Ch |
I/O restart ESI |
I/O restart ESI |
I/O restart ESI |
I/O restart ESI |
7F10h |
I/O restart EIP |
I/O restart EIP |
CR4 |
CR4 |
7F14h |
reserved |
CR4 |
CR2 |
CR2 |
7F18 |
reserved |
A20M# |
reserved |
reserved |
7F1Ah |
reserved |
7F1Bh |
??? |
7F1Ch |
reserved |
7F1Eh |
SMM_status |
7F20h |
CPL |
7F21h |
reserved |
7F23h |
shutdown |
7F24h |
alternative DR6 |
alternative DR6 |
ES limit |
ES limit |
7F26h |
RSM control |
RSM control |
7F28h |
CR4 |
sreg_status0 |
ES base |
ES base |
7F2Ch |
reserved |
DS selector |
ES access rights |
ES access rights |
7F2Eh |
DS access rights |
7F30h |
ES limit |
DS limit |
CS limit |
CS limit |
7F34h |
ES base |
DS base |
CS base |
CS base |
7F38h |
ES access rights |
FS selector |
CS access rights |
CS access rights |
7F3Ah |
FS access rights |
7F3Ch |
CS limit |
FS limit |
SS limit |
SS limit |
7F40h |
CS base |
FS base |
SS base |
SS base |
7F44h |
CS access rights |
GS selector |
SS access rights |
SS access rights |
7F46h |
GS access rights |
7F48h |
SS limit |
GS limit |
DS limit |
DS limit |
7F4Ch |
SS base |
GS base |
DS base |
DS base |
7F50h |
SS access rights |
IDTR selector |
DS access rights |
DS access rights |
7F52h |
IDTR access rights |
7F54h |
DS limit |
IDTR limit |
FS limit |
FS limit |
7F58h |
DS base |
IDTR base |
FS base |
FS base |
7F5Ch |
DS access rights |
TR selector |
FS access rights |
FS access rights |
7F5Eh |
TR access rights |
7F60h |
FS limit |
TR limit |
GS limit |
GS limit |
7F64h |
FS base |
TR base |
GS base |
GS base |
7F68h |
FS access rights |
sreg_status1 |
GS access rights |
GS access rights |
7F6Ch |
GS limit |
GDTR selector |
LDTR limit |
LDTR high |
7F6Eh |
GDTR access rights |
7F70h |
GS base |
GDTR limit |
LDTR base |
LDTR low |
7F74h |
GS access rights |
GDTR base |
LDTR access rights |
reserved |
7F78h |
LDTR limit |
LDTR selector |
TR limit |
TR limit |
7F7Ah |
LDTR access rights |
7F7Ch |
LDTR base |
LDTR limit |
TR base |
TR base |
7F80h |
LDTR access rights |
LDTR base |
TR access rights |
TR access rights |
7F84h |
GDTR limit |
ES selector |
GDTR limit |
GDTR limit |
7F86h |
ES access rights |
7F88h |
GDTR base |
ES limit |
GDTR base |
GDTR base |
7F8Ch |
GDTR access rights |
ES base |
IDTR limit |
IDTR limit |
7F90h |
IDTR limit |
CS selector |
IDTR base |
IDTR base |
7F92h |
CS access rights |
7F94h |
IDTR base |
CS limit |
reserved |
reserved |
7F98h |
IDTR access rights |
CS base |
reserved |
reserved |
7F9Ch |
TR limit |
SS selector |
I/O restart EIP |
I/O restart EIP |
7F9Eh |
SS access rights |
7FA0h |
TR base |
SS limit |
reserved |
reserved |
7FA4h |
TR access rights |
SS base |
I/O restart DWORD |
I/O restart DWORD |
7FA8h |
ES |
ES |
ES |
ES |
7FACh |
CS |
CS |
CS |
CS |
7FB0h |
SS |
SS |
SS |
SS |
7FB4h |
DS |
DS |
DS |
DS |
7FB8h |
FS |
FS |
FS |
FS |
7FBCh |
GS |
GS |
GS |
GS |
7FC0h |
LDTR |
LDTR |
LDTR |
LDTR |
7FC4h |
TR |
TR |
TR |
TR |
7FC8h |
DR7 |
DR7 |
DR7 |
DR7 |
7FCCh |
DR6 |
DR6 |
DR6 |
DR6 |
7FD0h |
EAX |
EAX |
EAX |
EAX |
7FD4h |
ECX |
ECX |
ECX |
ECX |
7FD8h |
EDX |
EDX |
EDX |
EDX |
7FDCh |
EBX |
EBX |
EBX |
EBX |
7FE0h |
ESP |
ESP |
ESP |
ESP |
7FE4h |
EBP |
EBP |
EBP |
EBP |
7FE8h |
ESI |
ESI |
ESI |
ESI |
7FECh |
EDI |
EDI |
EDI |
EDI |
7FF0h |
EIP |
EIP |
EIP |
EIP |
7FF4h |
EFLAGS |
EFLAGS |
EFLAGS |
EFLAGS |
7FF8h |
CR3 |
CR3 |
CR3 |
CR3 |
7FFCh |
CR0 |
CR0 |
CR0 |
CR0 |
Intel/AMD processor state after SMM entry |
register |
contents |
selector |
base |
limit |
access rights |
CS |
3000h #1 |
SMBASE |
(FFF)F_FFFFh |
8093h #2 |
SS |
0000h |
0000_0000h |
(FFF)F_FFFFh |
8093h |
DS |
0000h |
0000_0000h |
(FFF)F_FFFFh |
8093h |
ES |
0000h |
0000_0000h |
(FFF)F_FFFFh |
8093h |
FS |
0000h |
0000_0000h |
(FFF)F_FFFFh |
8093h |
GS |
0000h |
0000_0000h |
(FFF)F_FFFFh |
8093h |
EFLAGS |
0000_0002h |
EIP |
0000_8000h |
CR0 |
bits 0 (PE), 2 (EM), 3 (TS), and 31 (PG) cleared, rest unmodified |
CR4 |
0000_0000h |
DR7 |
0000_0400h |
IN_SMM |
true |
IN_HLT |
false |
IN_SHUTDOWN |
false |
IN_FP_FREEZE |
false |
BLOCK_INIT |
true |
BLOCK_SMI |
true |
BLOCK_NMI |
true |
LATCH_INIT |
true if INIT recognized together with SMI, else false |
LATCH_SMI |
false |
LATCH_NMI |
true if NMI recognized together with SMI, else false |
FERR# |
unmodified |
A20M# |
processor-specific |
notes |
description |
#1 |
On Intel P6-core processors the CS selector is instead loaded with SMBASE SHR 4. |
#2 |
Like the data segments, CS is writeable too. |
Cyrix pre-M2 processor SMM state save map |
offset |
3 1 |
3 0 |
2 9 |
2 8 |
2 7 |
2 6 |
2 5 |
2 4 |
2 3 |
2 2 |
2 1 |
2 0 |
1 9 |
1 8 |
1 7 |
1 6 |
1 5 |
1 4 |
1 3 |
1 2 |
1 1 |
1 0 |
9 |
8 |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
-30h |
ESI or EDI |
-2Ch |
I/O write data |
-28h |
I/O write data size |
I/O write port address |
-24h |
reserved |
H |
S |
P |
I |
r. |
-20h |
CS descriptor (bit31..0) |
-1Ch |
CS descriptor (bit63..31) |
-18h |
reserved |
CPL |
reserved |
CS selector |
-14h |
next EIP |
-10h |
current EIP |
-0Ch |
CR0 |
-08h |
EFLAGS |
-04h |
DR7 |
Cyrix M2 processor SMM state save map |
offset |
3 1 |
3 0 |
2 9 |
2 8 |
2 7 |
2 6 |
2 5 |
2 4 |
2 3 |
2 2 |
2 1 |
2 0 |
1 9 |
1 8 |
1 7 |
1 6 |
1 5 |
1 4 |
1 3 |
1 2 |
1 1 |
1 0 |
9 |
8 |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
-30h |
ESI or EDI |
-2Ch |
I/O write data |
-28h |
I/O write data size |
I/O write port address |
-24h |
reserved |
CPL |
reserved |
N |
r. |
IS |
reserved |
H |
S |
P |
I |
C |
-20h |
CS descriptor (bit31..0) |
-1Ch |
CS descriptor (bit63..31) |
-18h |
reserved |
CS selector |
-14h |
next EIP |
-10h |
current EIP |
-0Ch |
CR0 |
-08h |
EFLAGS |
-04h |
DR7 |
|